DRUPAL-CONTRIB-2026-245: Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

Q: Which deployments are affected?

Drupal Media Alias Display is affected in versions 0.0.0 through 2.1.2 and 3.0.0 through 3.0.2. Deployments outside those listed ranges are not identified as affected by the provided advisory data.

Q: Does an attacker need an account or user interaction to exploit this issue?

The CVSS vector indicates no privileges are required and no user interaction is required. Exploitation is rated high complexity and is associated with incorrectly configured access-control security levels.

Published Oct 30, 2026

Updated

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2.

Affected Software

1 affected component

Drupal Media Alias Display>=0.0.0<=2.1.2, >=3.0.0<=3.0.2

Event History

Oct 30, 2026

CVE Published

via OSV·03:09 AM

Data Sourced

via OSV·03:09 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Drupal Media Alias Display is affected in versions 0.0.0 through 2.1.2 and 3.0.0 through 3.0.2. Deployments outside those listed ranges are not identified as affected by the provided advisory data.

Does an attacker need an account or user interaction to exploit this issue?

The CVSS vector indicates no privileges are required and no user interaction is required. Exploitation is rated high complexity and is associated with incorrectly configured access-control security levels.

DRUPAL-CONTRIB-2026-245: Media Alias Display - Moderately critical - Information disclosure - SA-CONTRIB-2026-245

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does an attacker need an account or user interaction to exploit this issue?